Sensitive Data Exposure in Elasticsearch Logging Provider by Apache

CVE-2026-41018

What is CVE-2026-41018?

The Elasticsearch logging provider from Apache is subject to a vulnerability where, if configured with a host URL that includes embedded credentials (e.g., https://user:password@server.example.com:9200), it will log the complete host URL in task logs. This potentially allows any user able to read those task logs to extract sensitive backend credentials. To mitigate this risk, users are encouraged to upgrade to version 6.5.3 or later and to use a secret backend to manage credentials instead of embedding them in the host URL.

References